FROM debian:bullseye-slim

LABEL maintainer="brianhsiung@outlook.com"

ENV TENGINE_VERSION 3.1.0

COPY ngx_brotli /tmp/ngx_brotli
COPY tengine-3.1.0 /tmp/tengine-3.1.0
COPY nginx-module-vts /tmp/nginx-module-vts

RUN set -x \
    && addgroup --system --gid 101 nginx \
    && adduser --system --disabled-login --ingroup nginx --no-create-home --home /nonexistent --gecos "nginx user" --shell /bin/false --uid 101 nginx \
    && sed -i \
           -e 's/deb.debian.org/mirrors.tuna.tsinghua.edu.cn/g' \
           -e 's/security.debian.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apt/sources.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends --no-install-suggests ca-certificates build-essential libbrotli1 \
       libbrotli-dev gettext-base zlib1g zlib1g-dev libpcre3 libpcre3-dev libssl-dev fontconfig tar curl cmake \
# 官方nginx镜像中存在，编译安装的Tengine/Nginx不包含以下包
       readline-common libreadline8 libbsd0 libdeflate0 libgd3 libgeoip1 libicu67 libjbig0 libjpeg62-turbo libmd0 \
       libnsl-dev libtiff5 libwebp6 libx11-6 libx11-data libxau6 libxcb1  libxdmcp6  libxml2 libxpm4 libxslt1.1 \
    && cd /tmp/tengine-3.1.0 \
    && ./configure \
        --prefix=/etc/nginx \
        --sbin-path=/usr/sbin/nginx \
        --modules-path=/usr/lib/nginx/modules \
        --conf-path=/etc/nginx/nginx.conf \
        --error-log-path=/var/log/nginx/error.log \
        --http-log-path=/var/log/nginx/access.log \
        --pid-path=/var/run/nginx.pid \
        --lock-path=/var/run/nginx.lock \
        --http-client-body-temp-path=/var/cache/nginx/client_body_temp \
        --http-proxy-temp-path=/var/cache/nginx/proxy_temp \
        --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
        --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
        --http-scgi-temp-path=/var/cache/nginx/scgi_temp \
        --user=nginx \
        --group=nginx \
        --with-compat \
        --with-file-aio \
        --with-threads \
        --with-http_addition_module \
        --with-http_auth_request_module \
        --with-http_dav_module \
        --with-http_flv_module \
        --with-http_gunzip_module \
        --with-http_gzip_static_module \
        --with-http_mp4_module \
        --with-http_random_index_module \
        --with-http_realip_module \
        --with-http_secure_link_module \
        --with-http_slice_module \
        --with-http_ssl_module \
        --with-http_stub_status_module \
        --with-http_sub_module \
        --with-http_v2_module \
        --with-mail \
        --with-mail_ssl_module \
        --with-stream \
        --with-stream_realip_module \
        --with-stream_ssl_module \
        --with-stream_ssl_preread_module \
        --add-module=/tmp/ngx_brotli \
        --add-module=/tmp/nginx-module-vts \
        --add-module=modules/ngx_http_upstream_check_module \
        --add-module=modules/ngx_http_upstream_dynamic_module \
        --add-module=modules/ngx_http_upstream_session_sticky_module \
        --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' \
        --with-ld-opt='-Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie' \
    && make && make install \
    && apt-get remove --purge --auto-remove -y libbrotli-dev build-essential zlib1g-dev libpcre3-dev libssl-dev cmake \
    && rm -rf /var/lib/apt/lists/* && rm -rf /tmp/* \
    && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime; \
       echo "Asia/Shanghai" > /etc/timezone \
    && ln -sf /dev/stdout /var/log/nginx/access.log \
    && ln -sf /dev/stderr /var/log/nginx/error.log \
    && mkdir -p /etc/nginx/conf.d /usr/lib/nginx/modules /var/cache/nginx /docker-entrypoint.d

COPY nginx.conf /etc/nginx/
COPY default.conf /etc/nginx/conf.d

COPY docker-entrypoint.sh /
COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d
COPY 20-envsubst-on-templates.sh /docker-entrypoint.d
COPY 30-tune-worker-processes.sh /docker-entrypoint.d
ENTRYPOINT ["/docker-entrypoint.sh"]

EXPOSE 80

STOPSIGNAL SIGQUIT

CMD ["nginx", "-g", "daemon off;"]